Signature Base unknown stable yara

MAL_Janicab_LNK [yara]

detect LNK files used in Janicab infection chain

View Source

Detection Logic

uint32be(0x0) == 0x4C000000 and $dimensions and 2 of ($j_*)

Field Validations

Loading…

Comments (0)

Loading comments...